Executive brief
The Bottom Bar plugin for WordPress, which adds a customizable navigation or information bar to websites, contains a security flaw that allows unauthorized configuration changes. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify plugin settings such as language options or enabled sharing services. This could lead to unauthorized changes in how the website appears or functions for its visitors.
Technical details
The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification in the bottom-bar-admin.php file. Specifically, the main settings, sharing services, and restore defaults forms lack wp_nonce_field(), and the server-side processing fails to implement check_admin_referer() or equivalent validation before executing update_option(). An unauthenticated attacker can exploit this by inducing a logged-in administrator to submit a specially crafted POST request. Successful exploitation allows the attacker to modify plugin configuration options, including language settings and sharing service visibility.
Affected products
- WordPress Plugin Bottom Bar up to and including 0.1.7
Timeline
- 2026-05-20: disclosed: Initial advisory publication
References
- https://plugins.trac.wordpress.org/browser/bottom-bar/tags/0.1.7/bottom-bar-admin.php
- https://plugins.trac.wordpress.org/browser/bottom-bar/tags/0.1.7/bottom-bar-admin.php
- https://plugins.trac.wordpress.org/browser/bottom-bar/trunk/bottom-bar-admin.php
- https://plugins.trac.wordpress.org/browser/bottom-bar/trunk/bottom-bar-admin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/db0715ed-a06e-4a68-b9c3-408887cae113?source=cve